Send X-Cors-Proxy-Allowed-Request-Headers header on proxied requests

[maxschmeling]

With the release of WordPress/wordpress-playground#2007 we're able to explicitly enable the Authorization header on the CORS proxy. This allows us to make authenticated requests to APIs.

[chriszarate]

Looks good, in the future maybe this could actually respond to the headers in the request. It might look a little squirrelly on requests that don't need it

[maxschmeling]

Looks good, in the future maybe this could actually respond to the headers in the request. It might look a little squirrelly on requests that don't need it

I briefly considered two different options:

1. Stripping it off in the proxy so the X-Cors-Proxy-Allowed-Request-Headers header never gets passed through.
2. Doing what you suggest and not sending it to the proxy if the request doesn't contain the Authorization header.

But I figured the less logic we add to it, the better. However, I'm definitely still open to either option.